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Abstract of JP8315053 

PURPOSE: To provide a safe receipt-free betting 
system by using algorithm based upon number 
theory. 

CONSTITUTION: A bet generating center 10 
generates a betting choice to each better or each 
bet selecting means 12. Ciphering or shuffling is 
applied to a bet and the result of ciphering and 
shuffling is sent to the bet selecting means 12 
together with information on the method of 
applying shuffling to the bet without being 
intercepted on the way. The information is 
preferably transmitted through a safe tapping- 
disabled channel 16(i). Bet generation and 
shuffling verification using chameleon 
commitment and mutual communication proof 
can also be applied to this system. Thereby the 
betting system can be attained by using the 
tapping-disabled channel and a current personal 
computer provided with an access means to an 
electronic bulletin board. 
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(2) 

1 

(b) &&t<nzzf&<&&mmiR¥m\z#m*y± 

(c) saajR*»j&*8»fea«L*y*-s?fc«jfcr 

(d) ±E«IiaJi¥R*6©^yfe-^S«^ftE« 

-ft, 10 

(e) ±ESK#«Hz>*-tfi»££ttT4;*5 l y7* 

[»*«4] ±EiEStt£aEBJi-t57sxy7 p «, 1- 
0 KWTJtcfU X&ZmntZ Zt\z£K>ftt3.t>tlZ Z. 

t &®mt -r*, »*«3ti2«©*^p->-h7U 

t»*W5] (f) ±fE&ll£8j&TSXx-y7 p T& 
(g) 3>7 bZtltcVy b%m^Z>Zt\Z&r>mf$.2 

m 3 tcE«c©££& u->- h y u -sm^a. 

7 ] ±E«8S»R*a**±E* ;* • 3 

&®t?z>. w*i5icf2*c©££fci^>-h7U-& 

0 sEWTM >J XAfcHfrT-S Z. Hz*, ofrfcfrns r 

a*a7icE»©^^wv-h7'j 

9 ] ±ea*MR#a**±E* * P * > • a 

5y M>b*&s#ifc-rs7xs/7*te, assai^-r^ 

Jt&©tfc®®£±EJ§*M£l::4;L£ fc©T&-5 

8 if*. H#3i7itESi©££fcW>-b7'J-&Ii 

111*5110] ±E7xy7' (a) «. 50 



4$M¥8-3 1 5 0 5 3 

2 

(i) ±E#j&snfc&ss&~>*y7;i/f *± 

(i i) ±E->* >7 'J >yfcHf^.»ffl^ 

t>\z-£tsz.tz®mtrz>, m*muzmm<D$£ti.]s 

->-h7D-&M2F5£. 

ti, S^pJtE^^^-f ^USr^LTitSfe©-? 

2] ±E7.x^7* (a) tt. 
(1) ±mmf$,2tlti®m$:i'*y7)l?Z>Z.t, *5<t 

tf, 

(i i) ISvt y 7 'J >>f\zm-fZ>$tm* 
->-h7U-&H7J5£. 

[«*fll3] ±E»ffl*yfc— 7£2££Xx>yX 
tt. SK^Bjie^^?i?¥>^*^LT2l5t>©T 
&*;r<!:£#®£T-5. »#B4CE8©££fcl'->- 
h7y-a*J5rSC 

[BfcfcBl 4] ±E7xy7' (a) tt, 

(i) ±E*jfc3nfcSJR&5/*y7;H-*;:t, fcj; 

(i i) ±E~>* y 7 >J >7"(cH-f «y-fc-S?£, 
SC^tfC »#«5fcE«©££fcW 

->-h7U-aM^iC. 

[M*«15] ±E»ffl^>>-fc-^*ji-5X7 i y7' 
tt, J5^Blt6fe^^^v>^Sr^bTji-5fe©T 
afesri^gitts, »#5li 4KE«©££&W> 
-h7U-«3R*iC 

[tt$gl 6] ±EX5^7" (a) tt, 

(i) _hE«^$nfca^^v^^7;VT-5^<!:» *5<fc 

(i i) ±E->* 9 7 U >^ICH-T5»ffl^ y-fe-5?*, 

m&2tiz>z.tt£<, ±m^m9i^mz^zt^ 
t>\z'§tsz.t*®w.t-rz>. mimi \zum<D^±n.v 
->-h7'j-a^it. 

tt. 8&*15tgfc£££^¥>*;U£;frLT2£-5t)©T 
$>ZZ.£Z®m£t%, M&9I1 6fi:eft0>&£&l'3' 
-h7U-g^*SC. 

1 8 J ±E7.x 9 7 ( a ) 14. 
(i) ±E8 & £ nfc&M 7 ;W-r fcj: 

(i i) ±E->^ 9 7 U >^ICH1-S*ffl^ y-fe-^S, 

e»ic^tjit*i#mfr^, w*«3ice«©^^u 
v-h7U-as*s. 
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(3) 

3 

So 

[R^lR2 1] (f) 33i» M>h& 

(g) 35y hStifctfy h*JBV»*CfcfcJ:0±EII 
7t. 

(h) M^n5^ti4<f35ymxf-y7"tS: 

[It** 2 2] ±Et35? M--57x>y7'tt, ftlg 

Ht-r*. »#*2 lfcE«©££fcUv-h7U-i8 

[M$1R2 3] ±t3iEatt*SEWr^7x^7 , tt, BE 
Ws* 7 7)l7)ld>) XASrUfff^) CtCJ: Off**) 

[»*B2 4] ±faESttftKWr*^xy7T4, K 
-h7'J-S^iC. 

1"£7x77£;*?>l;:-£tj;i<!:£ftf8£-t£. B*St2 30 
1 KE«©£±fc l/y- h 7 U -feM7jSc 

[S#*2 6] Wl/t>-3*9h^>h$iSjft 
1"5 7x 7 7^2 e>lC#tJ -5. «*JS2 
3 CE«©££& h 7 U -gg^it, 

[B*JS2 7] _kE#*U:*> • 3 5 7 h*>h£*£ 
»5Xf7 ±E*>* y 7 U >£f©fca©ffc$ 

a *±ih*i^sic^ s ^ t * ^tr c t 1 1 
2 6 ice*©*£& Wy-hy u -&H7j5S„ 

[»*H2 8] «&©&l?£f£-k>*-,!:. 

as©s^sK#at. 40 

8**tH»>*-i:*«*.. 

M§«^tT±E^«±lc»^U, asm. ±E&g 

±ESHgiR^S©&*tt. t&HSgftf •&<!:£ fclc, 
i£j§$ft**7*->'£*JifcU 



ftM¥8-3 1 5 0 5 3 

4 

££fcUv--h7U-#SSgB. 
[11*9(2 9] ±EfS3S£j£-fe>*-tt. W&FUm 

E«©«^ftW'>-h7'J-iSW««.- 
[ft** 3 0] JbE4BH4**>^-tt, *^l^*> 

IStt^EfcSfc^fc?* LTx3l 

2 8 icE«©5fc^& u h 7 u -&mmw, 
mxm 3 1 ] ±Eg^ss?#stt. • a 

zftrntrz. «*Ji3 otcE«©^^i/->-h7'j 
hbhh&«. 

tw*S3 2] ±E«*snfc»»ss»tt*fc»© 

+ 7 7 'J >^t>^-0^ti/7W'> h£S 
A. 

±E->*7 7;l'*7 M*J©#S"1ry 7'J>iMz>* — 

^Slc*ffl*7-fc-S>£i§-5;:<i£ft8t'r-5. §»*« 
2 8 fcE8©&£fcW v- h 7 'J -SUSS. 

ft±Ejft*a«*afcis«ct*i**i:r*. a*«3 

2 CE*©££fc U >- h 7 U -Slgf. 
[W**3 4] ±E«j£2n&g:II£gtt££fc«>© 
•>t7 7U>^t>?-®->t 7 7^ 7 h * $ 6> tClt 

A. 

±E->^7 7JI/*7 hrtOgyf^U >y-fe>^- 

5, »*«3 0tcK*©££ftUv-h7U-&Ilg 
Bo 

[»*«3 5] Syf^U^yt^-tt, 

4 £E*©££fc US'- h 7 'J -fi^gf. 
[»*J5i36] lEv^^'J^t^-li 

fc. SMffi^©IEStt*IEM-rSXx77**fT^^C<!: 
£ft®i-r*. »*«3 2KE«©5Sf^*WS/-h7U 

*>• 3157 h^>h*ffl^T7>^A7 hU>^3 

5 7 hU 315 7 h$nfctf7 hSrffl^T^«^c©iE 
^tt$rfJEWU. ^S$tl^^i:^<x3i5 7 N-TSXx 
77*£;*e>l::fTfc-3;i££ftg<!:T*> »*a3 6lcE 

e©^c^ u h 7 u -&mmw. 

tW*fl3 8] ±Ex3 5 7h-r«.7>x7 7*fi, 
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(4) 

5 

Wit?*, »#JB3 7lc£«©££fcl^>-h7U-iS 
3 9 ] S&HSft? *^kt>-35 

ftsat-r-s. h^«3 7tcE*©££fti/>'-h7<j- 

t»*«4 0] &&%iMIR^m\t. *©«J®fi£±!2 

t ic i 0 * * • n s y * * > h £«£Mfc?-S £<h 
&#fSfTS, 9t#«3 9lcE«©££fcl/->--r-:7U i0 

[000 1] 

[s^©Ji-fsi£ffi#if] *%ujii, ^±^i/->-h7 

[0 0 0 2] 

[&*©««] s^^m^gMofi^a^fi, tisws 

#tCOHT©W3S#g#£n-5. 

[0 0 0 3] SiS-Cte, STOC9 4 (1 9 94^ 
rr) ©54 4~5 5 3HfC»«$nfc TRece i pt 
-free Secret-ballot Elect 
i on (l/5/-h7'J-»»SBRai|i) j igfSJ. 
C. Benaloh SOgftXC #>aW&H7n 
tBSfcO, S<^£*T^T©®^&M7a hajMcis 

tt. »J©#^SM^tcS^© 
ttJjZ&M L 0 f £ El & ©T?£ -SgBft^ © t ft o T 

[0004] Benalo aiJitfTu i n s t r a 
tt. SfSiwi/v-r^'J-m^&IST'nhrui^glgL 

#L*n#£5 6©**-c*.6a»*Hw-r*. feawg® 

[0 0 0 5] Z\nt\tmz, Ni emifcitfRenv 
al lit ASIACRYPT' 94 (1 9 9 4^8 50 



#M¥8-3 15 0 5 3 

6 

ft) ©14 l~14 8Hfc»*;£tt& THow to 
prevent buying of votes i 
n computer elections (3>tfa 

i em i *><D^J:lz$>\,*T. Z.(DjfflM%M&V<i:o tV 

tv»». «st>toi!»!8si7*-;*fcfl!K 

•C , T'<T©-fe>^-i:V;U5 1 /t-x^ ffrSfcfrfcd. 
[0 00 6] 

BW!«»(!HfcbJ:3fr*WB Benaloh-Tu 

1 n s t r a43<fctfN iemi-Renval 1 ©7n 
hUUDMJSth. ^&U->-h7UHWR*fi&IBT 

tt**&D»A/£5&'b©TaD, v»t# 

[0 0 0 7] 

[0 0 0 8] *5^K±*ft£fcl^>-h7iJ-iSa«r 
fcJBV»*;:fcfcJ:B, £*©=k5lc8:ML& 

i: ^ < -fc -ifcS * y -fe- 0 #-5 £ <h * . 
£©±5&£l&^Wj3gfc?v>*Ate. 1 9 92^10 
^^fiOSc ient i f ic American, 8 

2 6 7#f4^, 5 0~5 7M(C»«$nfc TQuan 
turn Cryptography (»^B£*§&) J t 
m-tZC. Bennett e>©inXlr8a«$nT^-5„ 
J5«^?III&5 l *>*;H6ffl^*Ct©«IW8*tt. IS 

l*j£&&SSft* 2/-t—7©7;P-7S:^Blt6tcr-5. 

fca»©*36tt?TIBTtta:V>. ffV4ljtna. S^nJfg 
[0 0 0 9] aT©R9ilC*^T. r*>l/t>OS 
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7 

[ooio] *^w©^tc«fcn«, 
7>s&-5. 

[0 0 11] flOXf'^ll «B&B-te>*-*». 

M«2as, ?ts.ti%, r i j it roj 

jrr*. i ic»lt, aa^i«-fe>^-H:. ? 

>fh.tsMm<n^^ixlt r i j mt r o j Hft^*. 

v*-J^Btt«]EL<«BLfc££*tt9i-r*. 35 

5»*-tt. BB^Bftft^fc^v^^fc^rLT-*© 

[0 0 12] l2©Xf7/ll »Ba-Jfrfe>*-*»S 
f^^tT^^. &vvy7 1 J>7'-fe>:$'-«, H7 

7;i/^ y h &ftVT®mm i tarr* 2 6©SBft->* 

^©lESttftfiEWTSo 3 BB^WBfcg 
4&ft>^M^H, BBB ifcttl/T©*, £© 

ck 5 fcaswss/ v y 7 jvts ntzfr fcaarr *. 

[0 0 13] »2©*^y7 , fo&B©'b©-ett&<. £ 

[0 0 14] B3©*xv7*ttftBB.fcJ:*E*iftBT 
**. !8:Ii*t©a8]©E?iJ«5*£. B2©Xxy7*fcis 
^T*nS#£©<fc5tCv*y7;l^nfc;frft£#LT 
*3<dt^«t0. *ftBBKtt£5&©B*«£*nra* 

*. ^ffic. *ir*>*-tt»Bft*ir»-r-&. 

[0 0 15] ft£&B*?lr>*;P©*«»i, 19 9 3 
¥%ff ©A dvances inCryptolog 
y, Eurocrypt '93©248~259H 
l£iiB£tlfc TEfficient Anon ymo u 
s Channel andAI 1/Noth ing 
Election Scheme (SWW&B^-f > 

*fr**zf*-fr • *7 • i-y»?&mjjis:) j tm 

T-5C. Park &©B£*>. *»WiH-©BBAK 



(5) #Ni¥8-3 1 5 0 5 3 

8 

BBSttfc rs e c u r e Anonymous Me 
ssage Transfer and Voting 
Scheme <££&B*;iv-fe-5>1EaU5J:tf»B 
>SfS» J iBf5*B»lTHlBB0 8/3 7 6, 5 6 8 

-7ft*- 7;P- 7 KdlST £ .C t C <fc 0 7\)l<- 7 Off 
£, ^xy*fc&BftaB**«fclttrM«fldB 

[0 0 16] 

10 [£tt©£B©BB] «T. *»«*; *#BB&£fr> 

trbmbbt*. 

[o o 1 73 *&m<D&zv\,*mm<Di&m\z£z££tf. 

V v- h 7 U -SUTJiSftE 1 iScfctfia 2 ft#S$LTtB 
WT*. *»W©35rS5K J:*itf, &HS§fi£7 , n-fe7 2 6 
K±0as^*-fe>^-l 0**3iBl,fc«*fldftBtt» 

(i) KBtT, 7>^AaBJ>JfcB'CBA& r l j m 
t roj B©*tjS>Sfc*. i&z&mzn&tyf-i o 
a? a. bbb*¥B 1 2 ( i ) fc*rr<&**Mtjjaw*£© 

<fc5fc:EJ!l3ttTV»*a>&. BB*BBfc*Y >*/H 

6 (i) S^LT, iSMS«?^g;12 (i) tCgS^ICfe 

B-T*. HBlc, SM4^-fe>^-l0«. 

Ttt. SBR«»^iEK*BSnfcCt*, &B8tt¥B£ 

*fLT«. -fe>*-l 0*t»B^-y-k-^«ft:«-3fcB 

i*S6ft^ftct«, *n^-ftBwr5<fc»a«* 
s. ^ne,©t£^tt. m^-r^ctoic. *©ra7a-t 
X2 o let ogfrsns. 

[0 0 18] SBSft^Bl 2 (i) tt, t/SWtCffilg 
5/7 TBBft^ir >*JH 6 (i) *^UTBB&S-t>^ 
-1 0*&&&ftSBB;K9-fe-S?£BtoT. -£©Hft 

siR-r-s. jasgft^ai 2 <n . 1 2 (2) . 
12 (1) KioaasnfeBBtt. &m$k^-t>?- 

1 5»C, B*ftB«?lr>*^**bTBE*TBBS 
-14 (1) . 14 (2) . 1 4 (n) iCJcOUSi 

KAOJfc^tBBSn. BieMHr>^-l 5*», 7> 
^Alc*»oBB^BCE?Ul/fc-B©#B*fl:»BtB 
« BBBt*B*-r«*TB»6n«. JJW4B-fe>^- 
10, 16BBiR^ai2 (i) . 5*-»^-fe>^-l 
4 (i) . g^SH-fe^^-l 5©#*tt. BB*R, 

7-7Xx-v3>-£©teTfcg£;t&K 
[0 0 1 9] £U, *BB©^3C©BB&RBl/^^ 
o€ft, fiRi«^DtX2 6t, H^7*n-feX2 0 
t, fiB^Ba:^*>^H 6*^LTB4ICBB* 
n*BB©BBKo«r»TBWT*. 
[0 0 2 0] 1 Ott. SH«^7*D-fe 

50 X2 6*BffT«J:ilCj:D. ^SSBJ?* S 1 2 
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(6) 



8-315053 



9 



10 



(i) KtfLT roj m&kts r i j m&ttzv&mt 
ffl^x, s&sisiR^ai 2 (i) \zm%&mm&y 

[0 0 2 U rij mt roj los|f«IH E=S 
-v >*)v\z xtit z> © \zm htz % ©t& e. u * 

v i 0 = (g ' 11 mod p, 
v i 1 = (g ' 12 mo d. p, 
Z. r . i fcitf r > 2 ttttJRSft^gk 12 ( i ) fc 
*ff 5&&&&-C<&D, p, g, y, mo . mi ttf^ 

[0 0 2 3] «!**jfrfe>$'-l 0«, 2#©1©?|$ 
T (v, 



vi ' ) ©«{;:, *tt£Wta (v, 1 , v 

CO 0 2 4].IEW7 p D-feX2 Ott. 3^©7;W:*'JXA 

A21, 1 -0ffiBJ7;V^iJXA2 2, t3S7 
h7JP:i'JXA2 3T?i&5. 3.5 7 M>h7;U:fJX 

o^©l - OaEBJ^a hn;ncfflv^n57> 

1 -omm7)^^XA\t, «ft0»fsn, sur^a 

•fe>*-i 0*s^iE(c!S:M<£^U, -€-©m?j#mT8 
aMRl 3±IC*|^$nT^-5CtS:IEBJ-r-5. T^5y 
M>b7;i^UXA2 3tt. £lg*nJtlfc££fc^-v 
>*^£;frLT, nSy M>b7;l^'JXA2 1 K* 

b?zrztr>\zm^t>ti5o i-omw&£Vt>*u 

t>o$y h^h/rasy b^>h©7;^'JX 
[0 0 2 5] 8:S±jS-fe>*-tt, *^l/t>'?35 

ft^Y>*^*^bTi!aewR*ai 2 (i) cas. 

[0 0 2 6] JSMSHR^ei 2 (i) tfcBEXD-feX 

2 4(CJ;0. 1 -0BEBJ!7;U:fJXA©iEMitt<>:> x3 

»ttWftttSn*t, SKHR^ftl2 (i) tt, 
Xn-fex2 5**frU »*«±0«H9fld9*©5"6. * 
Eo (v° ) = (g' ' mod 
E ) (v 1 ) = (g r " mo d 

Eo (v°) *s<fctfEi (v> ) 
[0 0 3 3] 2a. l/2©ltfS^oT. BH^g 

&SE#g:te. Eo (v° ) g£tfEi (V ) tf^jf? 

[0 0 3 4] 2b. l/2©|$$feot, K9J¥& 



ffi®m0 8/3 7 6, 5 6 8*KE«3ftft#iM3,fctf 

rij jut roj *©**fc»»*o*«!> 

[0 0 2 2] 

mo • y r 11 mod p) 

mi • y r iJ mod p) (1) 

[o o 2 7] smss??si 2 (i) 'cjcoaftshfc- 

[0 0 2 8] ±j£©;&i££igfflf5£:, JKft&Sfftftt 

^sw?ai2 (d \z*<»w&*wm%z\t*mi\ 

a? 1 6 (i) *>»wsnav»*€fo. gftanfc&isat 
rij roj *t*o&*>©ji#:«&:/;p 

- 7 i 5 C t »T*fcK 

[0 0 2 9] tatfic. l -oiEBjjftStfn:#*i^:*> • 
M>h/r3S7 M>h©7;Vr/'JXA&IB 
HJ-T-5. 1 -0SEW7;PrfUXA«, BE9J?gt£tttE? 

HftTfeiK i©7;P3f'JXA©«S^«jtt. SHift 
A5/->o.g|iS:©m*(Cj;i9ftS$n-5^ 7>^Atf- 
30 n>TfeJ;K 

[0 0 3 0] £©7;i^UXAtt, ^ (1) \ZLtzft-o 

T^$ns^$nfc. 7>yA(cM^^.fc» (v , 
°. V, ■) *sitr> -en?.*^is(c rij nt 

roj KO»Tf**tKWr*Ci*^TV»«. 
©tffi^f-5. . 

[0 0 3 1] l-0§EBJ7;W=f'JXA 
1. EWfRttr' , r" ^©ttg5 

[0 0 3 2] 
p, mo • y r mod p) 
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L Title of Invention 

Secure Receipt-Free Electronic Voting 

2. Claiffis 

1. A method of secure receipt-free voting comprising the steps of: 

(a) constructing votes for each vote chooser which votes are posted 
on a bulletin board; 

(b) sending private messages to respective vote choosers without 
being intercepted; 

(c) the vote chooser choosing the vote and constructing a message; 

(d) the menage from the vote chooser reaching a vote counting 
center through a secure anonymous channel; and 

(e) the vote counting center counting the votes. 

2. A method of secure receipt-free voting as set forth in claim 1, where said 
sending private messages comprises sending via secure untappable channels 

3. A method of secure receipt-free voting as set forth in claim 1, further com- 
prising the step of proving the correctness of the vote construction. 

4. A method of secure receipt-free voting as set forth in claim 3, where proving 
the correctness is performed by executing algorithm prove 1-0. 

5. A method of secure receipt-free voting as set forth in claim 3, further com- 
prising tie steps of: 

(f) said constructing votes including committing a random string 
using chameleon commitments; 

proving the correctness of the constructed votes by using com- 
mitted bits; and 
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(h) decommiting through a secure untappable channel. 

6. A method of secure receipt-free voting as set forth in claim 5, where proving 
the correctness is performed by executing the algorithm prove 1-0. 

7. A method of secure receipt-free voting as set forth in claim 5, further com- 
prising the vote chooser invalidating chameleon commitment. 

8. A method of secure receipt- free voting as set forth in claim 7, where proving 
the correctness is performed by executing the algorithm prove 1-0. 

9. A method of secure receipt-free voting as set forth in claim 7, where the 
vote chooser invalidating chameleon commitment provides its secret key for 
constructing votes to the bulletin board. 

10. A method of secure receipt-free voting as set forth in claim 1, where step 
(a) further comprises: 

(i) shuffling the constructed votes; and 

(ii) sending a private message about the shuffling to the vote 
chooser without being intercepted. 

11. A method of secure receipt-free voting as set forth in claim 10, where said 
sending a private message comprises sending via a secure untappable chan- 
nel. 

12. A method of secure receipt-free voting as set forth in claim 2, where step 
(a) further comprises: 

(i) shuffling the constructed votes; and 

(ii) sending a private message about the shuffling to the vote 
chooser without being intercepted. 

13. A method of secure receipt-free voting as set forth in claim 4, where said 
sending a private message comprises sending via a secure untappable chan- 
nel. 
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14. A method of secure receipt-free voting as set forth in claim 5, where step 
(a) farther comprises: 

(i) shuffling the constructed votes; and 

(ii) sending a private message about the shuffling to the vote 
chooser without being intercepted. 

15. A method of secure receipt-free voting as set forth in claim 14, where said 
sending a private message comprises sending via a secure untappable chan- 
nel. 

16. A method of secure receipt-free voting as set forth in claim 7, where step 
(a) further comprises: 

(i) shuffling the constructed votes; and 

(ii) sending a private message about the shuffling to the vote 
chooser without being intercepted. 

17. A method of secure receipt-free voting as set forth in claim 16, where said 
sending a private message comprises sending via a secure untappable chan- 
nel. 

18. A method of secure receipt-free voting as set forth in claim 3, where step 
(a) further comprises: 

(i) shuffling the constructed votes; and, 

(ii) sending a private message about the shuffling to the vote 
chooser without being intercepted. . 

19. A method of secure receipt-free voting as set forth in claim 18, where said 
sending a private message comprises sending via a secure untappable chan- 
nel. 

20. A method of secure receiptee voting as set forth in claim 10, further 
comprising the step of proving the correctness of the shuffled constructed 
votes. 
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21. A method of secure receipt-free voting as set forth in claim 20, further 
comprising the steps of: 

(f ) committing a random string using chameleon commitments; 

(g) proving the correctness of the shuffled constructed votes using 
committed bits; and 

(h) decommiting without being intercepted, 

22. A method of secure receipt-free voting as set forth in claim 21 where said 
decommiting is through a secure untappable channel. 

23. A method of secure receipt-free voting as set forth in claim 20, where said 
proving the correctness is performed by executing the algorithm prove shuf- 
fle. 

24. A method of secure receipt-free voting as set forth in claim 21, where said 
proving the correctness is performed by executing the algorithm prove shuf- 
fle. 

25. A method of secure receipt-free voting as set forth in claim 21, further 
comprising invalidating the chameleon commitment. 

26. A method of secure receipt-free voting as set forth in claim 23, further 
comprising invalidating the chameleon commitment. 

27. A method of secure receipt-free voting as set forth in claim 26, where the 
said invalidating chameleon commitment includes providing a secret key for 
said shuffling to the bulletin board. 

28. An apparatus for secure receipt-free voting comprising: 

a plurality of vote generating centers; 

a plurality of vote choosers; 

a bulletin board; 

a vote counting center; . 
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said vote generating centers constructing votes for each said vote 
chooser which votes are posted on said bulletin board and said 
vote generating centers sending private messages to respective 
vote choosers without being intercepted; 

each said vote chooser choosing the vote and constructing a mes- 
sage which reaches said vote counting center through a secure 
anonymous channel; and 

said vote counting center counting the votes. 

29. An apparatus for secure receipt-free voting as set forth in claim 28, where 
said vote generating centers send private messages to said vote choosers via 
secure untappable channels. 

30. An apparatus for secure receipt-free voting as set forth in claim 28, further 
comprising: 

said vote generating center committing a random string using 
chameleon commitment; proving the correctness of the vote 
construction using committed bits; and decommiting through 
a secure untappable channel. 

31. An apparatus for secure receipt- free voting as 6et forth in claim 30, further 
comprising said vote chooser invalidating the chameleon commitment. 

32. An apparatus for secure receipt-free voting as set forth in claim 28, further 
comprising: 

a shuffle net of shuffling centers for receiving said constructed 
votes; and 

each shuffling center in the shuffle net shuffling the votes and send- 
ing a private message to a vote chooser without being inter- 
cepted. 

33. An apparatus for secure receipt-free voting as set forth in claim 32, where 
each shuffling center sends a private message to a vote chooser via a secure 
untappable channel. 
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34. An apparatus for secure receipt-free voting as set forth in claim 30, further 
comprising: 

a shuffle net of shuffling centers for receiving said constructed 
votes; and 

each shuffling center in the shuffle net shuffling the votes and send- 
ing a private message to a vote chooser without being inter- 
cepted. 

35. An apparatus for secure receipt-free voting as set forth in claim 34, where 
each shuffling center sends a private message to a vote chooser via a secure 
untappable channel. 

36. An apparatus for secure receipt-free voting as set forth in claim 32, fur- 
ther comprising said shuffling centers proving the correctness of their vote 
construction. 

37. An apparatus for secure receipt-free voting as set forth in claim 36, further 
comprising: 

each shuffling center committing a random string using chameleon 
commitment and proving the correctness of its vote using com- 
mitted bits, and decommiting without being intercepted. 

38. An apparatus for secure receipt-free voting as set forth in claim 37 where 
said decommiting is through a secure untappable channel. 

39. An apparatus for secure receipt-free voting as set forth in claim 37, further 
comprising each vote chooser invalidating the chameleon commitment. 

40. An apparatus for secure receipt-free voting as set forth in claim 39, where 
each vote chooser invalidating the chameleon commitment by providing its 
secret key to said shuffling centers or to said bulletin board. 
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3. Detailed Description of Invention- 
Field of Invention 

The present invention relates to a method and apparatus useful for secure receipt- 
free electronic voting and specifically, to number- theoretic based algorithms for 
secure receipt-free electronic voting. 



Background of the Invention 

The. ultimate goal of secure electronic voting is to replace physical voting booths. 
Achieving this goal requires work both on improving the efficiency of current pro- 
tocols and understanding the security properties that these physical devices can 
provide. 

Recently,, it is observed in an article by J.C. Benaloh et al, entitled "Receipt- 
free Secret-ballot Election," in STOC 94, pp. 544-553 (1994), that unlike physical 
voting protocols, nearly all electronic voting protocols give the voters a receipt by 
which they can prove how they voted. Such receipts provide a ready means by 
which voters can sell their votes or by which another party can coerce a voter to 
vote in a certain way. 

Benaloh and Tuinstra give the first receipt-free protocol for electronic voting. 
In their scheme a trusted center generates for each voter a pair of ballots con- 
sisting of a "yes" vote and a "no" vote in random order. Using a trusted beacon 
and a physical voting booth the center proves to the public that the ballot indeed 
includes a well-formed (yes/no) or (no/yes) pair and at the same time proves to 
the verifier which pair it is. The physical apparatus ensures that by the time the 
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verifier is able to communicate with an outsider, the verifier can forge a proof that 
the ballot is (yes/no) and also forge a proof that it is (no/yes). Thus, such a proof 
ceases to provide either proof as a receipt. 

Independently, Niemi and Renvall tried to solve this problem in an article by 
Niemi et al, entitled "How to prevent buying of votes in computer elections" in 
ASIACRYPT '94, pp. 141-148 (1994). They also use a physical voting booth 
where a voter performs multiparty computation with all the centers. 

Both the Benaloh-Tuinstra and the Niemi- Renvall protocols illustrate that receipts 
free secure voting is possible. However, their physical requirements are fairly cum- 
bersome, and are not unlike those faced by participants in physical elections. An 
important open question is precisely what physical requirements are necessary for 
achieving receiptee secure voting. 

In accordance with the teachings of the present invention, a secure receipt-free 
voting scheme is described with a more practical physical requirement, that is the 
existence of a physically secure untappable private channel. 

Summary of the Invention 

A secure receipt-free voting scheme is described where each voter does not leave 
evidence of how the voter voted by using a physically secure untappable channel. 
The term "untappable secure channel" refers to the fact that a message can be 
sent from a center without being accessed or detected by another party. Such an 
untappable channel is described in an article by C. Bennett et al entitled "Quan- 
tum Cryptograph/' in Scientific American, vol. 267, no. 4, Oct. 1992, pp. 50 to 
57. The end result of using an untappable channel is that neither the voter nor 
another party can show or prove how a vote was cast or what was the message 
that was sent. Once a message is sent or received, the content may be changed 
rendering proof of the message impossible. However, if the message is intercepted 
or detected in route or at the time of reception, the intercepting or detecting party 
can learn the content of a message prior to a time when a change was possible. 
Moreover, even if a non-secure channel is used, if the message travels along the 
channel without interruption or detection, by virtue of the protocol used in the 
present invention, determination of a particular vote after receipt at its destination 
is not possible. In other words, an untappable channel refers to the transmission 



-509- 



1#M¥8- 3 1 5 0 5 3 



of a message without interception or detection in route. 

In the following description, the term 'chameleon commitments' is used. A chameleon 
commitment is a message committing and decommiting protocol, where the com- 
mitter can decommit as the committer committed, whUe the receiver can decom- 
mit in any way, regardless of how the committer committed. 

In accordance with the method of the present invention, there is a vote gener- 
ating center, a vote counting center, and shuffling centers to transfer messages 
between the various centers and each voter. The method comprises the following 
three steps. 

The first step is the generation by a voter generating center of a set of all possible 
votes for each voter. For simplicity, it will be assumed that the possible votes are 
two, namely 1-vote and 0-vote. For each voter t, the vote generating center posts 
encrypted 1-votes and 0-votes in random order. The committer commits to the 
ordering using chameleon bit commitments. The center proves that the committer 
constructed the vote-pairs prdperly. The committer decommits the ordering only 
to the voter through an untappable secure channel. 

The second step is the transferring the vote from the vote generating center to 
the voter via the shuffling centers. Each shuffling center shuffles the two votes 
for voter i through a shuffle-net. The committer commits with regard to how the 
votes are shuffled using chameleon commitments. Each shuffling center proves the 
correctness of its action. The committer reveals how the votes were shuffled only 
to the voter i through an untappable secure channel. 

The second step is not mandatory, in which case the vote generating center may 
directly send the vote to the voter through an ordinary channel. 

The third step is anonymous voting by the voter. By keeping track of the initial 
ordering of the pair, and how they were shuffled during the second step, each voter 
knows which vote is which. Each voter submits one of the received votes to the 
counting center through a secure anonymous channel. Then the counting center 
tallies the votes. 

Implementation of a secure anonymous channel can be found in an article by 
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C. Park et al entitled "Efficient Anonymous Channel and All/Nothing Election 
Scheme" in Advances in Cryptology, Eurocrypt '93, 1993, pp. .248 to 259, or 
in pending U.S. patent application serial number 08/376,568 entitled "Secure 
Anonymous Message TVansfer and Voting Scheme" which is assigned to the same 
assignees as the present invention. Also, the invention results in a method which 
reduces the amount of communication and computation necessary to generate, 
transmit and check the proofs by combining multiple proofs into a single proof. 

The present invention will be best understood when the following description 
is read in conjunction with the accompanying drawing. 

Detailed Description of the Invention 

A preferred embodiment of a secure receipt-free voting scheme comprising the 
present invention will now be described with reference to. Figures 1 and 2. In 
accordance with the scheme, the encrypted votes generated by vote generating 
center 10 by vote construct process 26 are posted on an electronic bulletin board 
13 or other publicly accessible messaging means. The encrypted votes are pairs 
of 1-votes and 0-votes, permuted in random order, for each vote chooser 12(i). 
Then the vote generating center 10 secretly conveys to the vote chooser 12(i) 
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through an untappable channel 16(i) how the encrypted votes for vote chooser 
12(i) is ordered. At the same time, the vote generating center 10 needs to prove 
to the public that the vote was honestly generated and to the vote chooser that 
the center 10 had not sent false information in the secret message. These proofs 
are achieved by following prove process 20 as will be described below. 

The vote chooser 12 (i) chooses its ballot using the secret message from the vote 
generating center 10 through a physically untappable channel 16(i). The vote 
chosen by the vote choosers 12(1), 12(2), ...12(£) are transferred anonymously 
through a secure anonymous channel to a vote counting center 15. The secure 
anonymous channel can be realized by the mixing centers 14(1), 14(2), . . .14(n), 
where encrypted votes are successively processed by the mixing centers until the 
vote counting center 15 provides as its output a randomly, untraceably ordered set 
of unencrypted votes and the outcome of the tally. Each vote generating center 
10, vote chooser 12(i), mixing center 14(i) and vote counting center 15 comprises 
a computing means, preferably a personal computer but it may also be a work- 
station or the like. 

Having set forth an overview of the scheme, the detail of vote construct pro- 
cess 26, prove process 20, and the information being transferred securely through 
untappable channel 16 will now be described. 

The vote generating center 10, by executing vote construct process 26, generates 
an encrypted pair of Q-vote and 1-vote for each vote chooser 12 (i). The center 
follows the vote construct process for each vote chooser 12(i) with independently 
chosen random numbers. 

The encrypted form of 1-votes and 0-votes need to be appropriate for input to 
the anonymous channel. Preferably, the method and apparatus described in U.S. 
patent application 08/376,568 which is incorporated herein by reference, is used 
and the encrypted forms of 1-votes and 0-votes are selected to be: 

v? = (g T n mod P, m Q • y r n m od p) 

= (g T \2 ra od p, m { • y T i2 mod p) (1) 

for independent random numbers r„ and r a for vote chooser 12(i) and appro- 
priately chosen common constants p,g,y,mo and mi for all vote choosers. The 
vote construct process 26 comprises calculating the above formulas with randomly 
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chosen numbers r iv and r i2 . 

The vote generating center 10 posts on the bulletin board in the order of 
with probability of one half and otherwise. 

The prove process 20 comprises three algorithms: commitment 21, prove 1-0 22, 
and decommitment 23. The algorithm commitment 21 is used to calculate and 
post a chameleon commitment of the above ordering and a random sequence used 
in the succeeding prove 1-0 protocol. The algorithm prove 1-0 is executed multiple 
times to prove that the center 10 generated the votes honestly, and the output 
is posted on bulletin board 13. The algorithm decommit 23 is used to decom- 
mit the chameleon commitment committed in algorithm commit 21, through an 
untappable secure channel. The specific algorithms of prove 1-0 and chameleon 
commitment/decommitment will be described below. 

The vote generating center sends an output of a decommitter, which is a chameleon 
decommitment, to the vote chooser i through the untappable channel. 

The vote chooser 12(i) verifies the correctness of the prove 1-0 algorithm and 
the validity of decommitments by verification process 24. If the correctness and 
validity are verified, the vote chooser 12(i) follows selection process 25 and chooses 
either one of the encrypted votes on the bulletin board, which expresses its opin- 
ion. The vote chooser is able to choose correctly because it would know how the 
encrypted votes were ordered from the chameleon decommitment. 

The vote chosen by the vote chooser 12 (t) will be input to a shuffle-net, together 
with other votes chosen by the other vote choosers; 

Applying the scheme described above, a malicious party who coerces the vote 
chooser 12 (i) to disclose its vote, will not receive a concrete proof of whether the 
chosen vote was a 1-vote or a 0-vote unless the vote generating center 10 is allowed 
to disclose the vote or the secure channel 16(i) is tapped into. 

The algorithms prove 1-0 and chameleon* commitment/decommitment will now 
be described. The prove 1-0 algorithm involves a prover and a verifier. The 
prover is the vote generating center in this case. The verifier may be any entity, 
including vote choosers. The probabilistic behavior of the algorithm will be de- 
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termined by an output of a suitable hash function, but it may also be a random 
beacon. 

The algorithm comprises, given randomly permuted pair of (v^ t v}) generated and 
posted as equations (1), showing that they are indeed a pair of 1-vote and 0-vote. 
Assume a random string has been committed using chameleon commitment to the 
vote chooser. 

prove 1-0 

1 The prover uniformly chooses r'.r" and calculates 

E 0 (v°) = (g r ' mod p 3 rr^ • y*' mo d p) 
Ei(v l ) = (gr" mod p 3 m ] • ?/ r "mod p) 

and posts Eq(v°),Ei(v 1 ) in the order according to the committed string. 

2a, With probability ^, the prover is asked to reveal r' and r". The verifier 
checks if £fl(t/°), E\(v l ) is made consistently. 

2b, With probability ^, the prover is asked to reveal si = rn — r 1 and s2 = 
rj 2 — r". The verifier checks that t£ and v} can be indeed generated from 
Eq(v q ), E x (v l ) using si, 52, g and y. 



The chameleon commitment scheme will now be described. The chameleon com- 
mitment scheme involves a: sender and a receiver. The sender is the vote generating 
center in this case. The receiver are the vote choosers. 

The following is explained in terms of committing a single bit, 0 or 1, but can 
be easily transformed to commit multiple bits and strings. In the scheme, the 
receiver is assumed to know a satisfying a = (f* for public integer a. 

Commitment Sender commits 0 by g r and a • g T for 1 to the receiver. 

Decommitment Sender reveals r. The receiver calculates both g T and a-g' and 
determines what was the committed bit. 
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In order to modify the decommitment, the receiver may claim it received r - a 
instead of r, which is the case when the sender committed the other value. 

A more detailed description of chameleon commitments can be found in article 
"Minimum Disclosure Proofs of Knowledge" by Brassard, Chaum and Crepeau in 
JCSS, pages 156-189, 1988. 

After the vote generating center decommitted its random string, the vote chooser 
12(i) may follow with invalidation process 27 to invalidate the commitment of the 
center. The invalidation process 27 comprises informing the center of the value a, 
so that the center also has the ability to provide false information afterwards, or 
to post the value a on a bulletin board 13. 

lb make sure that the vote chooser has the ability to modify the commitments, 
that is, the vote chooser knows the exponent a, the interaction may occur be- 
tween the vote generating center and each vote chooser, before the commitment 
is applied, or even before the start of voting. For example, the vote choosers may 
execute a cnt-and-choose protocol to pick the constant a so that the vote chooser 
knows a with high probability. 

In order to make the receipt-free property more secure, it is possible to incorpo- 
rate a shuffle net 11 comprising multiple shuffling centers 11(1), 11(2),. . .ll(m), 
as shown in Figures 3 and 4. Each encrypted vote generated by vote generating 
center 10 for vote chooser 12(t) is passed through shuffle net 11 before reaching 
the vote chooser 12(i). As a result of so doing, a malicious party would not be 
able to determine bow the vote chooser 12(t) voted unless it colluded with all 
the shuffling centers and vote generating centers, or wiretapped every secret chan- 
nel 17(1), 17(2), . . .17(m) between the shuffling centers and the vote chooser 12(i). 

Each vote shuffling center comprises a computing means, preferably a personal 
computer but it may also be a workstation or the like. 

The operation of the shuffle net and shuffling, centers will now be described. Shuf- 
fling center processes each message posted by the previous shuffling center 
- 1) (or the vote generating center 10, when j = 1) and posts the results of 
process shuffle 30 (Figure 5) in permuted order until the last shuffling center ll(m) 
posts the result of the shuffling. Each shuffling center conveys how the votes were 
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shuffled to the vote chooser through an untappable secure channel 17(j). Each 
shuffling center proves it shuffled honestly and did not provide false Information to 
the vote chooser in a manner similar to that of the vote generating center, -which 
is achieved through executing process prove 31. 

Figure 5 illustrates the operation of a shuffling center ll(i). The shuffling center 
ll(i) executes the processes shuffle 30 and prove 31 and posts the outputs. The 
process prove 31 comprises an algorithm commitment 32 which chameleon com- 
mits the random string to the vote chooser. 

The process prove 31 further comprises three algorithms: commitment 32, prove 
shuffle 33, and decommitment 34. 

In order to describe the process shuffle 30, let the input be encrypted shuffled 
votes, which are presented as: 

*i = (A U A 2 ) 

The algorithm shuffle comprises generating a random number c x and c 2 and shuf- 
fling the encrypted votes Xi and X 2 as 

S(X X ) - (A l * g c i mod p, A 2 • y c \ mod p) 

S(X 2 ) = (B l * g c 2 mod V* B 2 • yC 2 m od P) (2) 

and posting S(X\) and S(X 2 ) in random order. 

This order and a random sequence to be used in the algorithm prove shuffle is 
committed using chameleon commitment and posted on the bulletin board as the 
output of algorithm commitment 32. 

The algorithm prove shuffle 33 is used to prove that the shuffling center executed 
the algorithm shuffle correctly. The prove-shuffle algorithm involves a prover and 
a verifier. The prover is the shuffling center in this case. The verifier may be 
any entity, including a vote chooser. The probabilistic behavior of the algorithm 
will be determined by an output of a suitable hash function, but it may also be 
a random beacon. The algorithm comprises a permuted pair of {S(X l ) 9 S{X 2 )) t 
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showing that they are indeed generated from inputs X { and Xi as equations (2). 
Assume a random string has been committed using chameleon commitment to the 
vote chooser. 

prove shuffle 

1. The prover uniformly chooses c'.c" and calculates 

E(X l ) = (A l • gC mod Pj a 2 . y c' mod p) 
E(X 2 ) = (B l • g c "mod p, B 2 • i/ c "mod p) 

post E(Xi), E{Xi) in the order according to the committed string. 

2a. With probability \ y the prover is asked to reveal d and e". The verifier 
checks if E{X X ) % E{X 7 ) is made consistently. 

2b, With probability^, the prover is asked to reveal t y = c,-c' and t 2 = c 2 -c". 
The verifier checks that E{X{) and E(X 2 ) can indeed be generated from 
S(Xi) y S(Xz) using tub, 9 and y. 

The encrypted votes posted by the vote generating centers are successively pro- 
cessed by the shufiling centers 11(1), 11(2), . . .ll(m) until the last center provides 
as its output a randomly, untraceably ordered set of encrypted votes for each vote 
chooser. 

The vote chooser 12(i) chooses its ballot using the secret messages from the vote 
generating center and shuffling centers through untappable secure channels 16 (i), 
17(l) J 17(2),...andl7(m). 

Invalidation of chameleon commitments of shuffling centers can be realized in 
a similar manner as invalidated commitments of vote generating center. 

Having described a preferred method of practicing the present invention, pre- 
ferred embodiments useful for practicing the invention will now be described. 

Figure 1 schematically illustrates a preferred embodiment for practicing the inven- 
tion. The vote generating center 10, vote choosers 12(1), 12(2), . . . 12(f), mixing 
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centers 14(1), 14(2), . . .ll(n) and vote counting center 15 use personal computers 
or workstations connected to a conventional electronic bulletin board 13. There 
are untappable secure channels 16(1),16(2) . . . 16(£) so that the vote generating 
center can send a secret message to each vote chooser. All elements (senders, 
verifiers, centers and the like) comprising the message transfer process interact by 
posting messages to and receiving messages from the bulletin board 13, except 
when the vote generating center sends decommitting messages to vote chooseis 
via untappable channel 16. The vote generating center or vote choosers or vote 
counting center can also serve as mixing centers or vote counting centers. The per- 
sonal computers either contain software to perform the method described above 
or alternatively contain in hardware or software embodiments of the elements de- 
scribed in Figure 2. 

Figure 2 illustrates how messages are transferred to achieve receipt-free voting. 
Fbr each vote chooser 12(i), vote generating center 10 generates encrypted votes 
using a vote constructor 26 as described above. The vote generating center then 
follows process prove 20 which comprises algorithms commitment 21, prove 1-0 22 
and decommitment 23. The output of decommitment is sent to vote chooser 12 (i) 
through untappable channel 16 (i). Other outputs of the vote generating center 10 
is posted on the bulletin board 13. The vote chooser 12(i) follows the processes 
verification 24 and selection 25, and outputs selected votes from the encrypted 
votes on the bulletin board. The selected votes of all the vote choosers 12(1), 
12(2) . . . 12(£) are anonymously transferred to vote counter 15 through anony- 
mous channel 14. 



Figure 3 schematically illustrates a preferred embodiment for practicing the in- 
vention with a shuffle net. The vote generating center 10, vote shuffling centers 
11(1), 11(2), ...ll(m), vote choosers 12(1), 12(2), ...12(£), mixing centers 14(1), 
14(2), . . .ll(n) and. vote counting center 15 use personal computers or workstations 
connected to a conventional electronic bulletin board 13. There are untappable 
channels 16(1),16(2) . . . 16(£) so that the vote generating center can send a secret 
message to each vote chooser. There are .also untappable channels 17(1),17(2) 
...17(m) so that the shuffling centers ll(i), 11(2), ...ll(m) can send a secret 
message to vote chooser 12(i). All elements (senders, verifiers, centers and the 
like) comprising the message transfer process interact by posting messages to and 
receiving messages from the bulletin board, except for the vote generating center 
or shuffling centers which send decommitting messages to a vote chooser via un- 
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tappable channels. The vote generating center or vote choosers or vote counting 
center or shuffling centers can also serve as mixing centers or vote counting centers 
or shuffling centers. The personal computers either contain software to perform 
the method described above or alternatively contain in hardware or software em- 
bodiments the elements described in Figures 4 and 5, 

Figure 4 illustrates how messages are transferred to achieve receipt-free voting 
with a shuffle net. For each vote chooser 12 (i), vote generating center 10 gener- 
ates encrypted votes which are posted on the bulletin board 13. Then shuffling 
center 11(1) reads encrypted votes from the bulletin board 13 and follows pro- 
cesses shuffle 30 and prove 31, and output shuffled votes to the bulletin board 13, 
while sending a decommitting message to vote chooser 12(i) through untappable 
channel 17(1). Similarly, the succeeding shuffling centers read the proceeding cen- 
ters output from bulletin board 13, and post its output to the bulletin board for 
the next shuffling center, while sending its decommitting message to vote chooser 
12(i) through untappable channel 17(1). The last shuffling center's output will 
be read by the vote chooser 12(i), which follows the processes verification 35 and 
selection 36, and outputs selected votes from the encrypted votes on the bulletin 
board. The selected votes of all the vote choosers 12(1), 12(2) . . . 12{£) are anony- 
mously transferred to vote counter 15 through anonymous channel 14. 

Figure 5 schematically illustrates a shuffling center ll(i). The shuffling center 
follows process shuffle 30 and process prove 31. Process prove 31 comprises algo- 
rithms commitment 32, prove shuffle 33 and decommitment 34. 

While there has been described and illustrated a preferred method and appa- 
ratus of secure receipt free electronic voting, it will be apparent to those skilled in 
the art that variations and modifications are possible without deviating from the 
broad teachings and spirit of the present invention which shall be limited solely 
by the scope of the claims appended hereto. 
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Figure 1 is a schematic illustration of a preferred embodiment for practicing the 
present invention; 

Figure 2 is a schematic illustration of message flow; 

Figure 3 is a schematic illustration of a preferred embodiment for practicing the 
present invention with shuffling centers; 

Figure 4 is a schematic illustration of a message flow with shuffling centers; and 
Figure 5 is a schematic illustration of a shuffling center. 
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SHUFFLING CENTER 11(i) 



SHUFFLE 30 



PROVE 31 

COMMITMENT 32 



PROVE SHUFFLE 33 
DECOMMITMENT 34 



FIG 5 



L Abstract 

A number-theoretic based algorithm provides for secure receipt-free voting. A 
vote generating center generates a choice of votes for each voter or vote chooser. 
The votes are encrypted, shuffled, and conveyed to a vote chooser along with 
information regarding how the votes were shuffled without being intercepted en 
route. The information is preferably sent along untappable secure channels. The 
method can incorporate validification of generation and shuffling of the votes using 
chameleon commitment and interactive proofs. The invention can be realized by 
current-generation personal computers with untappable channels and access to an 
electronic bulletin board. 



2. Representative Drawing 
FIG 1 
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